p PatchFirst

CVE-2025-48038

CVE-2025-48038 · Unverified File Handles can Cause Excessive Use of System Resources

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

CVSS 5.3 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • erlang

    Versions
    • ≥ 3.0.1: Affected; ≥ 5.3.3: Not affected; ≥ 5.2.11.3: Not affected; ≥ 5.1.4.12: Not affected (otp)

    Update to 5.1.4.12

  • erlang

    Versions
    • ≥ 17.0: Affected; ≥ 28.0.3: Not affected; ≥ 27.3.4.3: Not affected; ≥ 26.2.5.15: Not affected (otp)
    • ≥ 07b8f441ca711f9812fad9e9115bab3c3aa92f79: Affected; ≥ 4e3bf86777ab3db7220c11d8ddabf15970ddd10a: Not affected; ≥ f09e0201ff701993dc24a08f15e524daf72db42f: Not affected (git)

    Update to 26.2.5.15

  • erlang Debian:12

    Versions
    • 1:25.2.3+dfsg-1
    • 1:25.2.3+dfsg-1+deb12u1
    • 1:25.2.3+dfsg-1+deb12u2
    • 1:25.2.3+dfsg-1+deb12u3
    Affected ranges
    • ECOSYSTEM: < 1:25.2.3+dfsg-1+deb12u4

    Update to 1:25.2.3+dfsg-1+deb12u4

  • erlang Debian:13

    Versions
    • 1:27.3.4.1+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 1:27.3.4.1+dfsg-1+deb13u1

    Update to 1:27.3.4.1+dfsg-1+deb13u1

  • erlang Debian:14

    Versions
    • 1:27.3.4.1+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 1:27.3.4.3+dfsg-1

    Update to 1:27.3.4.3+dfsg-1

  • erlang Ubuntu:Pro:14.04:LTS

    Versions
    • 1:16.b.1-dfsg-4ubuntu1
    • 1:16.b.2-dfsg-1ubuntu1
    • 1:16.b.2-dfsg-2ubuntu1
    • 1:16.b.3-dfsg-1ubuntu1
    • 1:16.b.3-dfsg-1ubuntu2
    • 1:16.b.3-dfsg-1ubuntu2.1
    • 1:16.b.3-dfsg-1ubuntu2.2
    Affected ranges
    • ECOSYSTEM: < 1:16.b.3-dfsg-1ubuntu2.2+esm1

    Update to 1:16.b.3-dfsg-1ubuntu2.2+esm1

  • erlang Ubuntu:Pro:16.04:LTS

    Versions
    • 1:18.0-dfsg-1ubuntu1
    • 1:18.0-dfsg-1ubuntu2
    • 1:18.2-dfsg-2ubuntu1
    • 1:18.3-dfsg-1ubuntu1
    • 1:18.3-dfsg-1ubuntu2
    • 1:18.3-dfsg-1ubuntu3
    • 1:18.3-dfsg-1ubuntu3.1
    • 1:18.3-dfsg-1ubuntu3.1+esm1
    Affected ranges
    • ECOSYSTEM: < 1:18.3-dfsg-1ubuntu3.1+esm2

    Update to 1:18.3-dfsg-1ubuntu3.1+esm2

  • erlang Ubuntu:Pro:18.04:LTS

    Versions
    • 1:20.0.4+dfsg-1ubuntu1
    • 1:20.1.2+dfsg-1ubuntu1
    • 1:20.1.3+dfsg-1ubuntu1
    • 1:20.1.4+dfsg-1ubuntu1
    • 1:20.1.5+dfsg-1ubuntu1
    • 1:20.1.6+dfsg-1ubuntu1
    • 1:20.1.7+dfsg-1ubuntu1
    • 1:20.2.1+dfsg-1ubuntu1
    • 1:20.2.2+dfsg-1ubuntu1
    • 1:20.2.2+dfsg-1ubuntu2
    • 1:20.2.2+dfsg-1ubuntu2+esm1
    Affected ranges
    • ECOSYSTEM: < 1:20.2.2+dfsg-1ubuntu2+esm2

    Update to 1:20.2.2+dfsg-1ubuntu2+esm2

  • erlang Ubuntu:Pro:20.04:LTS

    Versions
    • 1:22.0.7+dfsg-1build1
    • 1:22.2+dfsg-1
    • 1:22.2.1+dfsg-1
    • 1:22.2.2+dfsg-1
    • 1:22.2.3+dfsg-1
    • 1:22.2.3+dfsg-2
    • 1:22.2.4+dfsg-1
    • 1:22.2.7+dfsg-1
    • 1:22.2.7+dfsg-1ubuntu0.2
    • 1:22.2.7+dfsg-1ubuntu0.3
    • 1:22.2.7+dfsg-1ubuntu0.4
    • 1:22.2.7+dfsg-1ubuntu0.5
    Affected ranges
    • ECOSYSTEM: < 1:22.2.7+dfsg-1ubuntu0.5+esm1

    Update to 1:22.2.7+dfsg-1ubuntu0.5+esm1

  • erlang Ubuntu:22.04:LTS

    Versions
    • 1:23.2.6+dfsg-1build1
    • 1:24.1.1+dfsg-1
    • 1:24.1.4+dfsg-1
    • 1:24.1.5+dfsg-1
    • 1:24.1.5+dfsg-1ubuntu1
    • 1:24.2+dfsg-1
    • 1:24.2.1+dfsg-1
    • 1:24.2.1+dfsg-1ubuntu0.1
    • 1:24.2.1+dfsg-1ubuntu0.2
    • 1:24.2.1+dfsg-1ubuntu0.3
    • 1:24.2.1+dfsg-1ubuntu0.4
    • 1:24.2.1+dfsg-1ubuntu0.5
    Affected ranges
    • ECOSYSTEM: < 1:24.2.1+dfsg-1ubuntu0.6

    Update to 1:24.2.1+dfsg-1ubuntu0.6

  • erlang Ubuntu:24.04:LTS

    Versions
    • 1:25.2.3+dfsg-1
    • 1:25.3.2.8+dfsg-1
    • 1:25.3.2.8+dfsg-1ubuntu1
    • 1:25.3.2.8+dfsg-1ubuntu3
    • 1:25.3.2.8+dfsg-1ubuntu4
    • 1:25.3.2.8+dfsg-1ubuntu4.1
    • 1:25.3.2.8+dfsg-1ubuntu4.2
    • 1:25.3.2.8+dfsg-1ubuntu4.3
    • 1:25.3.2.8+dfsg-1ubuntu4.4
    Affected ranges
    • ECOSYSTEM: < 1:25.3.2.8+dfsg-1ubuntu4.5

    Update to 1:25.3.2.8+dfsg-1ubuntu4.5

  • erlang Ubuntu:25.10

    Versions
    • 1:27.3+dfsg-1ubuntu1
    • 1:27.3+dfsg-1ubuntu1.1
    • 1:27.3.4.1+dfsg-1
    • 1:27.3.4.1+dfsg-1build1
    Affected ranges
    • ECOSYSTEM: < 1:27.3.4.1+dfsg-1ubuntu0.1

    Update to 1:27.3.4.1+dfsg-1ubuntu0.1

Original sources

Check your server →